Download GitLab 8.16.1 / 8.15.5 / 8.14.7 / 8.13.12

You can compare GitLab with the more famous GitHubbut contains some subtle differences. It is an environment for managing Git repositories on-premises and is released under the MIT Expat license and developed in Ruby on Rails. It is available in two versions, namely the free to use Community Edition and a paid Enterprise Edition with more features aimed at large companies. The two flavors are on this page explained. The development team has released updates to GitLab versions 8.16, 8.15, 8.14, and 8.13 to address some security vulnerabilities.

GitLab 8.16.1, 8.15.5, 8.14.7, and 8.13.12 Security Release
Today we are releasing versions 8.16.1, 8.15.5, 8.14.7, and 8.13.12 for GitLab Community Edition (CE) and Enterprise Edition (EE). These versions contain important security fixes, and we recommend that all affected GitLab installations be upgraded to one of these versions.

Prevent users from creating notes on resources they can’t access
An attacker was able to use the API to post comments on resources that they would not otherwise be able to view, which would “subscribe” them to the notifications for that resource and allow them to receive future updates about it, which may contain sensitive information . see #26249 and #26250 for more details.

Prevent users from deleting system deploy keys via the project deploy key API
An attacker was able to delete a system-level deploy key by deleting it from a project they owned via the Deploy Key API. see #26243 for more details.

Ensure export files are removed after a namespace is deleted
If a user performed a project export and then deleted (or moved) its containing namespace, an attacker could claim the namespace and access the existing project export if less than an hour had passed. We now ensure that project exports are immediately removed along with the namespace. see #26242 for more details.